Solutions · Software supply chain security
Run only the images you can verify.
Kyverno checks image signatures, SBOMs and attestations when a pod is admitted. If an image is unsigned, or missing an attestation you require, the pod doesn't start.
ImageSigSBOMProvDecision
registry.example.com/payments/api:1.8.2verifiedverifiedverifiedAllow
registry.example.com/data/worker:2.0.0verifiedverifiedverifiedAllow
docker.io/library/nginx:latest↳ verify-image-signaturemissingmissingmissingDeny
registry.example.com/billing/app:3.1.0↳ require-sbom-attestationverifiedmissingverifiedDeny
Verification happens at admission, in every cluster
Signature verification
Check Sigstore and Notary signatures before a pod is admitted. Works with Cosign, Venafi and AWS Signer.
Attestation checks
Require an SBOM, vulnerability scan or build provenance (in-toto or raw JSON) before an image is admitted.
Trusted sources
Allow-list the registries you trust and block mutable tags like latest, so the image you scanned is the image that runs.
The last mile of supply chain security
Nirmata verifies image signatures and attestations with configurable policy as code, and integrates with solutions from AWS, Azure and Venafi.
With Nirmata you can:
- Integrate with an existing image signing platform like Cosign, Notary, Venafi, and AWS Signer.
- Verify image attestations, including signed metadata like SBOMs, scan reports, provenance data, and scorecards.
- Verify OCI image manifest data like layers, build time, etc.
- Enforce image build from trusted sources and repositories.
- Block malicious or unauthorized containers
- Achieve SLSA compliance (opens in a new tab)